Bienvenidas a la versión beta del manual "Zen y el arte de que la tecnología trabaje para ti". Entre los meses de Setiembre y Diciembre 2015 queremos entender mejor cuales son las necesidades de las personas que leen este manual en relación a su privacidad y seguridad. También nos gustaría identificar otras herramientas, procesos, casos de estudio que podrían ser añadidos en la versión finalizada de este manual.

Esta guía es un recurso construido desde la base y pensado para nuestra creciente comunidad de mujeres y personas trans*, activistas, defensoras de derechos humanos y tecnólogas. Ha sido diseñada para aglutinar una colección creciente de informaciones y recomendaciones útiles que resuenen con nuestras necesidades, experiencias y activismos, cuando estamos conectadas pero también cuando no lo estamos.  

Los contenidos listados en esta guía han sido creados en respuesta a las demandas de nuestra comunidad por ideas y asesoramiento en relación a temas importantes pero que no podían encontrar documentados propiamente en otros lugares. Esta guía se encuentra en construcción y no contiene muchos temas de gran interés, no obstante esperamos poder incluirlos en el futuro gracias al apoyo y aportes de las personas que lo lean. La guía actual cubre esencialmente dos temas que se superponen:  

* Primero, como podemos “diseñar presencias apropiadas” (o una conjunto de ellas) que refuercen nuestra habilidad para comunicar y trabajar de manera segura cuando estamos conectadas?  

* Segundo, como podemos de manera colaborativa “crear espacios seguros” (conectados o físicos) que permitan a nuestras comunidades compartir, comunicar y crecer?  

Esta guía surgió del Gender and Technology Institute [1], organizado por Tactical Technology Collective y la Association for Progressive Communications (APC) en 2014. El instituto brindó alrededor de 80 participantes y facilitadoras—en gran parte originarias del sur global—y se focalizo en los desafíos afrontados por las mujeres y personas trans* en espacios conectados, pero también fuera de ellos, y afín de compartir estrategias y herramientas para proteger mejor nuestra privacidad y seguridad, así como para mejorar el compartir conocimientos sobre esos temas dentro de nuestras comunidades y organizaciones. Desde esas fechas, nuestra red ha crecido, y esta guía se ha nutrido de los aportes y las revisiones de un gran numero de personas. Se basa en historias y practicas creativas por parte de activistas de la base, activistas de la privacidad, facilitadoras de seguridad digital y holistica, así como personas creando tecnologías alrededor del mundo.  

Esta guía también es informado por el trabajo de abogacía de organizaciones como APC y otras que están trabajando en transformar los derechos a internet en derechos humanos. Esto significa ampliar el foco de las discusiones a nivel político centradas en proveer de acceso a las tecnologías a las mujeres y niñas para también incluir el uso de violencias basadas en las tecnologías como parte y prolongación de la violencia contra las mujeres así como basada en el genero. Fenómenos como el ciber-acoso, el discurso de odio y el chantaje violan el derecho de las mujeres y las personas tras* a la privacidad, el trabajo, la participación publica, la libertad de expresión y opinión, así como ser libres de cualquier tipo de violencia. Estos fenómenos también nos pueden causar que nos censuremos y nos abstengamos de hablar libremente. Todo ello refrena nuestra capacidad de ser y tomar parte de los varios movimientos y comunidades a los cuales contribuimos.  

En un entorno de tal complejidad, las actividades que desarrollamos (en linea y fuera de internet), nuestras identidades y realidades pueden parecer separadas, pero resultan a menudo profundamente entrelazadas. Por todo ello, puede darse un alto nivel de confusión o incertidumbre acerca de las intenciones, identidades y acciones de los demás y todo ello puede volvernos fácilmente ansiosas o deseosas de retíranos de cualquier tipo de actividad en su conjunto.  

 

 

¿ Cómo podemos como mujeres y personas trans * desarrollar niveles de confianza y una mayor sensación de seguridad cuando utilizamos tecnologías efímeras para crear contenidos, relacionarse con los demás, crecer redes de confianza, y crear espacios seguros para nosotras mismas? Esta guía explora algunos de los comportamientos que podemos adoptar, y adaptar, individualmente y colectivamente para desarrollar los niveles de confianza y de seguridad que necesitamos para seguir disfrutando de las libertades y el empoderamiento que Internet nos ofrece de forma única.  

La primera parte del manual analiza los rastros de información (a menudo invisibles) que se crean y se registran cuando usamos la Internet, servicios en línea, y otros dispositivos digitales. Ofrece estrategias y herramientas libres diversas para recuperar el control de estas huellas/trazas digitales. Describe en que consisten estas huellas, cómo se crean, y que se puede "saber" gracias a ellas. En su conjunto, estas huellas digitales individuales pueden formar contornos nítidos de quienes somos, que hacemos, lo que nos gusta, y cómo actuamos.

 

Llamamos a estas agregaciones de huellas digitales "sombras digitales," y vamos a discutir por qué importan y cómo podemos minimizarlas. La minimización de nuestras “sombras digitales" implica poderosas, creativas y divertidas tácticas para la gestión de diferentes tipos de identidades en línea. Vamos a presentar sus distintas opciones y formas varias de gestionar estas identidades en línea, así como analizaremos que riesgos y beneficios pueden presentar el uso de identidades 'anónimas' '' '' ', seudónimos' '' '' ', nombres colectivos '' 'y' '' nombres reales '' '.  

Esta guía se ha desarrollado en el transcurso del primer año del programa “Securing Online and Offline Freedoms for Women: Expression, Privacy and Digital Inclusion”, y fue escrita para las personas y colectivos que quieren mejorar sus practicas en cuanto a seguridad y privacidad, así como para las personas que ya están facilitando y ayudando a otras en mejorar su capacidad de auto-defensa, incluyendo una perspectiva de género a todo ello. Por favor, háganos saber lo que opinan de este contenido y ayúdenos en mejorarlo [2]. También le invitamos a participar en el diseño y creacion de futuros capítulos que le resulten de ayuda, dentro de su trabajo y sus comunidades.

Mientras te encuentres leyendo este manual (y poniendo en practica elementos que contiene), resulta importante tener algunas ideas en mente. Incluir el género en la privacidad y la seguridad nos obliga a adoptar un enfoque interseccional - uno que se relaciona con la diversidad de culturas, condiciones sociales, identificaciones de género, orientaciones sexuales, razas, etnias, creencias y otras estructuras de poder que pueden crear desigualdades para los individuos y las comunidades en cuanto a su acceso a las herramientas y prácticas de privacidad y seguridad digital. También nos obliga a mirar a la privacidad y la seguridad desde una perspectiva de género, en el cual se tenga una visión amplia de la tecnología, incluyendo las condiciones bajos las cuales se fabrican o como operan las leyes para relacionadas con la gobernanza de internet. Todo ello incluye:  

* '''Reconocer que las brechas de género, la discriminación y la violencia de género son a la vez estructurales y discursivas '' 'ya que están profundamente arraigadas en el lenguaje, las narrativas, las definiciones, las estructuras sociales y las leyes. Todas ellas influyen profundamente en las condiciones en las cuales las mujeres y las personas trans * acceden y experimentan con la tecnología e internet.

* '''Entender cómo las mujeres y personas trans * en diferentes condiciones encuentran formas de acceder a las tecnologías '' ', y una consideración hacia cómo pueden protegerse a sí mismas y a otros en ese proceso.

* '''Compartir habilidades y conocimientos en la base '' 'para que las mujeres y las personas trans* pueden fortalecer su libertad de opinión y de expresión.

* Recordar que es importante '' 'hacer visible las experiencias de las mujeres y personas trans * en la gestión y desarrollo de las tecnologías' '' (no sólo las digitales, sino también las tecnologías de la salud, por ejemplo).

* Trabajar para '' 'permitir una mayor participación de las mujeres y las personas trans * en las instituciones que contribuyen a la gobernanza de internet' '', así como dentro de las empresas y organizaciones que proveen servicios que apoyan nuestro trabajo en red e identidades en línea.

* ̈'''Imaginar tecnologías liberadoras que permitan la plena realización y el ejercicio de los derechos humanos, y que se muestren inclusivas de la diversidad' '', es la responsabilidad de cualquier persona involucrada en la creación de un Internet inclusivo accesible, descentralizado y neutral, no sólo de las mujeres y las personas trans *.  

Como prolongación de todo ello, cuando elegimos utilizar algún tipo de tecnología, sistema o servicio digital, deberíamos preguntarnos: ¿Se trata de una tecnología liberadora o esta basada en la enajenación de ciertas personas o grupos sociales? Las tecnologías liberadoras pueden ser definidas como aquellas que han sido diseñadas para ser producidas y distribuidas de manera justa, basándose en los principios del software libre y el código abierto, oponiéndose a su 'obsolescencia programada', e incorporando la privacidad y la seguridad en su centro. En el mismo espíritu, pero siempre determinado en ultima instancia por lo que las usuarias hacen con las tecnologías, podrían tratarse de sistemas y servicios digitales que se muestran resistentes o refractarios a la vigilancia y la violencia de género.[3]  

Muchas de estas cuestiones se plantean en los Principios Feministas de Internet [4] desarrollados por APC en 2014, cuando reunieron un grupo de defensoras de los derechos de la mujer y activistas feministas a una reunión mundial sobre Género, Sexualidad e Internet. Los principios miran las formas en las cuales internet puede ser un espacio público y político transformador para las mujeres, las personas trans * y las feministas. También colocan la violencia relacionada con la tecnología, en la continuidad de la violencia de género, dejando claro el aspecto estructural de la violencia y mostrando como se vinculan, amplían o reproducen prejuicios y estereotipos en actitudes en linea.  

Valentina pelizzer hvale de One World Platform nos explica que los principios "deben ser parte de la agenda de cualquier activista feminista, grupo u organización y deben ser consistentes y por defecto parte de la estrategia de las Defensores de Derechos de la Mujer, porque el feminismo por el cual abogamos es una extensión, un reflejo y una prolongación de nuestros movimientos y resistencia en otros espacios, públicos y privados ... un espacio de agitación y de construcción de las prácticas políticas para que internet facilite nuevas formas de ciudadanía que permitan a las personas reclamar, construir y expresarnos nosotras mismos, nuestros géneros y sexualidades ". [5]

'''''Esto es un proceso: Permanezca centrada, cultive la paciencia, y practique el auto-cuidado'''''  

Lo primero que hay que recordar cuando usemos esta guía, es que hemos utilizado el concepto "zen" en su título para poner de relieve que cuando usemos tecnologías debemos aceptar con filosofia que esta no funciona siempre a la perfección. A veces puede que tenga que tomarse un tiempo para ponderar la importancia y significado de estas tecnologías en su vida, en su comunidad y en su mundo en general. Otras veces puede que tenga que tomar un descanso y volver a ella.  

Hemos escrito el manual de tal forma que recoge la sabiduría y el consejo de mujeres y trans* activistas, con una especial atención para las problemáticas para las cuales nuestra comunidad no ha encontrado soluciones o documentación satisfactoria. También esperamos que genere nuevas preguntas, ideas, y resulte inspiradora. La mayor parte de los contenidos aquí tratados son estrategias y tácticas, que invita al ingenio y la creatividad, y puede ser resultar divertidos de explorar y aprender.  

Hay que apuntar que el contenido de esta guía no es la de una guía técnica o de seguridad tradicional y al uso; no está escrita para una orientación, configuración e implementación detallada de las herramientas presentadas. Si se proporcionan enlaces hacia recursos técnicos más intermediarios y avanzados de este tipo, pero el enfoque actual se orienta mas hacia la toma de conciencia, el desarrollo de estrategias y de tácticas implicando que no dividimos las secciones entre niveles de conocimiento "básico" o "avanzado". Invitamos una amplia diversidad de niveles y habilidades a entrar, salir y explorar esta guía conforme a sus propios intereses y necesidades.  

El contenido de esta guía debe ser interpretado como una conjunto de estrategias y tácticas contextuadas que complementan el conocimiento de base presentado dentro de la Caja de Herramientas de Seguridad desarrollado por Tactical Tech y Frontline Defenders [6]. No obstante, el deseo de una accesibilidad amplia a esta guía nos ha forzado a no exigir o asumir que las personas lectoras tengan un nivel básico de conocimientos y experiencias con la privacidad y seguridad digital. Las personas con estos conocimientos tendrán un sentido más detallado de los matices técnicos y los diversos contextos al leer esta guía, y posiblemente se encontraran en una mejor situación para absorber y aplicar este primer conjunto de contenidos.  

El aprendizaje y la aplicación de cualquier tipo de conocimientos complejos se vuelve un proceso, y todas nosotras, desde la técnica más experta hasta la mas inexperta- nos encontramos en nuestros propios puntos de desarrollo en ese proceso. No puede ser apresurado, cuanto más aprendemos y ponemos en practica, cuanto mas fácil y divertido se vuelve. Si en algún momento se siente frustrada o bloqueada (y eso nos pasa a la mayoría), recuerde de ser amable con usted misma y pensar en lo mucho que ya ha aprendido hasta ahora y en cuantos temas resulta ya excelente. En cualquier caso no dude en hacer preguntas y buscar ayuda, tanto en linea como fuera de ella.  

Por último, ya que estamos todas en diferentes momentos en el proceso de aprendizaje y uso de herramientas de seguridad digital, la mayoría de nosotros contamos con áreas que podríamos aprender acerca o profundizar mas. En la sección de esta guía intitulada [[Complete_manual#Establishing_a_baseline_of_privacy_and_security_knowledge|'Estableciendo una base en relación a privacidad y seguridad digital']], encontrará descripciones y enlaces hacia una lista de temas básicos e intermedios en relación a privacidad y seguridad que le permitirán amplificar sus tácticas y estrategias digitales. Algunos de los temas incluidos se refieren a: cómo funciona Internet, diferentes tipos de cifrado y cómo usarlos, cómo evaluar sus niveles de riesgo, cómo configurar y utilizar diferentes tipos de canales de comunicación seguros, y más. A medida que esta guía evolucione y se expanda en los próximos años, esperamos poder incluir cada vez mas temas que respondan a nuestra comunidad y sus necesidades.  

¿Cuánta información digital (o "datos") crees que existen acerca de ti? ¿Qué tipo de datos se han creado acerca de tu identidad, redes sociales y hábitos cuando utilizas plataformas digitales - como Facebook o Google- y dispositivos digitales, como el celular y la computadora? ¿Cómo se relacionan y reflejan lo que eres y lo que haces cuando estas conectada o fuera de línea? Si alguien quisiera investigarte, ¿qué podrían averiguar acerca de ti con los datos digitales que existen?  

Resulta útil pensar en todos los datos digitales que existen acerca de ti como tus '' '' rastros digitales '' '' - una información que puede contar una historia muy detallada de ti y tus actividades. Compone una especia de "sombra digital" '' '' '' que creamos y a la cual vamos agregando más datos cuando usamos herramientas y servicios digitales. El concepto de '' '' rastros digitales '' '' incluye datos que creas y ves de manera intencional - como los tuits que compartes públicamente o una entrada de blog en tu sitio web, lo que comúnmente llamamos como "contenido". Los rastros digitales son creados por ti y también por otras personas publicando activamente información, todo ello incluye lo que escribes, publicas y compartes, así como el contenido que otras personas crean acerca tuyo cuando te etiquetan en fotos, te mencionan en tweets, o simplemente se comunican contigo a través de un correo electrónico o una sesión de chat.

Los '' '' rastros digitales '' '' también incluye piezas de datos que se crean acerca de tu contenido y que en su mayoría resultan invisibles, comúnmente llamados 'metadatos'. Estos rastros son casi siempre creados de forma pasiva, sin que te des cuenta necesariamente, o sin que consientas a ello. Por ejemplo, tus hábitos de navegación y dirección IP son compartidas entre los sitios web que visitas y los servicios que utilizas para poder realizar un seguimiento de tu comportamiento y tratar de venderte productos a través de la publicidad. Junto con el contenido que creas tales como mensajes de texto, actualizaciones de redes sociales, fotos, también se encuentran miles de millones de trozos de metadatos relativamente pequeños que se van creando y almacenando dentro del mundo digital cada vez que envías un correo electrónico, navegas por la web, o cuando tu celular o cualquier otro dispositivo digital se conecta y envía información a Internet. Estos "rastros digitales" pueden incluir tu nombre, ubicación, contactos, fotos, mensajes, tuits y similares, pero también puede tratarse de la marca de tu computadora, la duración de tus llamadas telefónicas o información acerca de las paginas web que visitas.  

Los '' 'Metadatos' '' son datos acerca de tus datos, incluyendo cómo y cuando se crearon, donde se han almacenado, desde donde se han enviado, o cuándo y dónde te conectaste para subirlos a internet. La mayoría de los metadatos es información necesaria para que funcione la infraestructura básica sobre la cual se rigen nuestros sistemas digitales, incluyendo Internet y nuestros celulares. Los metadatos también permiten que se entreguen sus correo electrónicos correctamente, que tu computadora encuentre tus archivos donde los dejaste, y en general que puedas recibir mensajes de texto y llamadas telefónicas desde todo el mundo de forma casi instantánea.

El '' 'ruido' '' son los datos que se generan ya sea por el proceso de fabricación de dispositivos y hardware físicos, ya sea por como operan y se mueven físicamente, por ejemplo como gira el disco en disco duro. Un ejemplo de ruido es la tarjeta SD común que utilizamos para grabar y almacenar fotografías digitales en nuestras cámaras. Cada tarjeta SD tiene "arañazos" únicos que son producidas por las máquinas que los fabrican, y son similares a las huellas digitales. Éstos hacen cambios microscópicos que no son visibles para el ojo, pero pueden ser reconocidos por las computadoras.  

'''''Quien puede colectar nuestros ‘rastros digitales’?  

Puedes preguntarte acerca de cuanto relevante puede resultar una imagen, un mensaje o una llamada telefónica. También es común pensar que hay tantos datos por ahí que nadie sabe qué hacer con ellos, o que nadie se preocupa demasiado acerca de ellos. Sin embargo, hay muchas partes interesadas en esos datos por una variedad de razones, y los avances en el análisis de datos significa que podemos analizar hoy en día grandes cantidades de datos como que nunca antes.  

Las empresas los colectan con la finalidad de analizar tu comportamiento y hábitos con la finalidad de venderte productos y servicios, así como para hacer que lo que venden sea "mejor". También venden sus datos y análisis acerca de ti a otras empresas e incluso a gobiernos con fines de lucro.

Como vimos en los documentos de Snowden, los gobiernos quieren tener acceso a la mayor cantidad de información acerca de ti como puedan conseguir, incluso si esto significa romper las leyes nacionales e internacionales. Los gobiernos quieren un nivel de acceso total a fin de controlar y gestionar las sociedades, y ello puede incluir elegir como blanco grupos marginados, censurar la actividad en línea de ciertos medios y, o incluso “vallar” su país del resto del mundo conectado. Los individuos pueden desear esta información para acosar, chantajear, o espiar a miembros de su familia, cónyuges, ex parejas o simplemente personas cuyo estilo de vida no están de acuerdo con. Algunos individuos y redes criminales también pueden querer robar datos de las empresas y los gobiernos para poder vender esa información financiera con fines de lucro, o agregar información en la cual estan interesados acerca de ciertos individuos y grupos.

La recopilación y análisis de datos es cada vez más sofisticada. Vemos los resultados de esta agregación y su análisis en la forma en que se comercializan y se nos proporcionan servicios cada vez más convenientes, no obstante muy pocas personas vemos o entendemos hasta qze punto las corporaciones, gobiernos e individuos conocen los detalles íntimos de la vida de millones de personas a través de la recopilación de datos y su análisis. El modelo de negocio de estos datos se da para la mayor parte de las aplicaciones y servicios gratuitos, para los cuales estamos regalando nuestros datos a cambio de servicios gratuitos. Esto significa que si no estas pagando es que eres el producto.

Los diferentes tipos de rastros digitales que creamos van siendo registrados y almacenados. Esos rastros son constantemente recogidos, ordenados y analizados por diversas partes a fin de crear o completar perfiles tuyos. Rutinariamente, cada vez que se crea una nueva pieza de información o metadato, este es grabado y agregado junto con otros datos para su análisis, y luego estos se agregan a tu perfil. Estos perfiles están en constante expansión y van variando según los diferentes proveedores de servicios. Proveen a los que crean o tienen acceso a ellos una perspectiva muy detallada de quien eres (o como te presentas), lo que te gusta, lo que sabes, lo que haces, tus hábitos diarios y tus interacciones con los demás. Frecuentemente, una recolección y análisis en profundidad de estos datos puede incluso hacerte realizar cosas acerca tuyo que no sabias. Un ejemplo de ello son las numerosas aplicaciones de "salud" y otros dispositivos de rastreo que son usados por la gente para controlar su ejercicio, ingesta de alimentos, movimiento físico a fin de realizar un seguimiento y analizar de que manera una esta o no mejorando sus hábitos de salud, permitiendo a la app formularte consejos individualizados sobre los pasos que tienes que ir tomando. Aparte de un pequeño puñado de excepciones, todos estos datos son recopilan y almacenados por los cientos de empresas que proveen estas aplicaciones y dispositivos de rastreo.

Los datos generados por nuestras acciones digitales pueden ser comprados y vendidos a los anunciantes y los gobiernos, y pueden ser usados de diversas maneras para controlar, suprimir o silenciar activistas, parejas u organizaciones nacionales. Los datos agregados y analizados pueden ser utilizados para crear estrategias de acoso que dañen tu reputación o para atacar tus opiniones o creencias. Todos los actores antes mencionados pueden tener acceso a tus datos y pueden acceder a ellos de diferentes maneras, incluyendo a través de la vigilancia de tus actividades, el acceso físico a tus dispositivos no cifrados, explotando el compartimiento de datos entre aplicaciones, o por medio de la investigación de fuentes de datos públicamente disponibles acerca tuyo. También pueden usar algunos de estos datos para localizar nuevas fuentes de datos acerca tuyo y a través de la agregación y análisis de datos inferir cosas sobre su vida y tu comportamiento.

We frequently hear companies and services (and even some researchers and non-profit organizations) argue that they protect users by '''anonymizing''' the data they collect, so your 'privacy' is safe with them. But it has been proven that our data traces are so unique to us—just like our fingerprints—that if data analysts have a small sample set of data about us, they can analyse that information to uniquely identify and reveal individuals according to the distinctive types and patterns of digital traces we create that form our ‘digital shadows’.  

Depending on who you are and what you do, you will probably have different concerns about the kinds of data or ‘digital traces’ that are the most sensitive for you, as well as who can access them. This may make you feel uncomfortable. But you are not alone, and there are a number of things you can do to reduce the creation and capture of your digital traces.

You may also wonder how the data you create may be used about you now versus how years and years of data about you could be used in the future by whomever has access to it then. Worldwide, there are very few laws that effectively regulate data collection or protect us from this historically unprecedented level of data collection. This makes it even more important for us to support privacy-protecting laws and standards with an eye to the future as well as the present.  

It also makes it important that we remain aware of this issue that is relatively ‘invisible’, benefiting corporations and governments, and find ways to tell others about it. We can also ask ourselves if we really need to tweet, record and stream all the things we do in life. And finally, we can fight back by regaining control of the digital traces we create and limiting who can collect and use them and we can also help by showing our friends, networks, and family members how they can do this too.

'''Relevant links:'''

* '''Trackography''': (https://trackography.org/) an interactive map exploring how the global tracking industry is recording your online behaviour.  

* '''What is Metadata?'''ː (https://www.privacyinternational.org/?q=node/573) Privacy international video explaining what metadata is and why we should care about it.  

* '''Do not track''': (https://donottrack-doc.com/en/about/) is a personalized documentary series about privacy and the web economy.

* '''In Limbo''': (http://inlimbo.tv/en/) is a documentary about internet privacy, digital identity, and online communications in which you can enter your own data enabling to see your digital self being peppered throughout the film.

'''Further Readingsː'''

* Sticky data: Why even 'anonymized' information can still identify youː (http://www.theglobeandmail.com/technology/digital-culture/sticky-data-why-even-anonymized-information-can-still-identify-you/article19918717/).

* Ed Felten explains how you can tell someone had an abortion from studying the metadata of their phone calls: (http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/27/heres-how-phone-metadata-can-reveal-your-affairs-abortions-and-other-secrets/).

* Hello Barbieː (http://www.washingtonpost.com/blogs/the-switch/wp/2015/03/11/privacy-advocates-try-to-keep-creepy-eavesdropping-hello-barbie-from-hitting-shelves/) points at the limits of eavesdropping, privacy and how devices are sending data to third actor parties.  

* The five eyes alliance: (https://www.privacyinternational.org/?q=node/51) is a video by Privacy International that explains the global communications surveillance arrangement of english-speaking States and what it means for your privacy.

* The Snowden Surveillance archivesː (https://snowdenarchive.cjfe.org/greenstone/cgi-bin/library.cgi) is a collection of all documents leaked by former NSA contractor Edward Snowden that have subsequently been published by news media.  

==== <big>Exploring</big> ====

We can't know exactly what happens to our digital traces when they're created, nor who has access to them. This itself is a problem. Although this situation might seem dire, there are a number of very simple ways you can learn more about the kind of data traces you're creating, who likely has access to them, as well as how to reduce the quantity and types of digital traces. Some companies and governments want users to give up and believe that this is the ‘way things should be’, because they are profiting enormously from the data collection and analysis environment enabled by the technology sector. Nonetheless you can begin to better control and reduce what is known about you without completely walking away from mobile phones, computers, email and social networks. The trick is to understand that it’s a process of learning and making small changes in how you use technology and various digital services. A lot of it is quite fun and interesting as you learn more about how technology works, and how to be playful with the data traces you create.

We encourage you to demystify these issues for yourself and with friends. Explore tactics for reducing and regaining control of your digital traces, and minimising—or creatively fabricating—the 'digital shadow' that companies have used to construct profiles about you. One of the most important things you can do is to become aware of the data you give away. Some examples of how you can minimize your traces and regain control include reducing the amount of data that you give away; consciously stripping valuable information from the content you create and share; learning and practicing the art of '''self-doxing''' to be aware of what others can know about you, and creatively developing ways to alter, separate, or re-create your online presence and identity.  

The strategies and tools detailed below can increase your privacy, and help you to be more secure both online and offline without being less vocal or reducing your activites online. As we move towards regaining control over our data, good places to start is to see what that data looks like, and explore the size, depth and characteristics of our digital 'shadows'. Below are some tools to help you do that.

'''Relevant links:'''

'''Further Readingsː'''

* '''My digital shadow''': (https://myshadow.org/visualisations/animation) is a short animated video by Tactical tech explaining digital shadows.

* '''Do not track episode''': (https://episode3.donottrack-doc.com/en/) about how facebook can profile you.

===== Self-doxing =====

Another strategy for knowing and exploring what is already available about you online is to ‘dox’ yourself. The word ‘dox’ is a shortened version of the word ‘documents’. Doxing is the act of gathering detailed information about someone using sources that are freely available although it can also involve illegally gaining access to personal data when used to attack others. This technique is used by activists, investigative journalists, and hackers (both good and bad) to profile subjects and organizations of interest. Doxing is also used to profile individuals and organizations by adversaries who want to exploit human and technical networks for malicious reasons. Criminals, spies, stalkers, and harassers also ‘dox’ their targets. Of course, this same practice and approach is two way and can also be used to learn more about someone we have met online before we give them our full trust.  

Please note that ‘doxing’ is typically defined as the act of both gathering personal data about someone and then publishing it online in order to endanger, harass, or threaten them. Here, we are suggesting you dox yourself in order to preventively know what is available about you online, and even take steps to reduce that data when possible. Successful doxing depends on the ability of the person to recognise valuable information about the target, and use this information in combination with other discovered data traces to construct a set of data as complete and comprehensive about them as possible.  

'Self-doxing', or researching what is openly available about you online, is a technique that can help you make informed decisions about what you share online, and how. Take into account that you might be surprised or frighten by what you might find about yourself. You might want to do the exercise with some good friends so you can discuss and strategise about what is coming up. Once you’ve doxed yourself, take a look at the data you’ve accessed and think about what a stranger may be able to figure out or reveal about you from what they’ve found. If you feel you and others close to you (such as fellow activists) are at increased risk, you may want to look for publicly available connections between you and members of your network as well. Remember though, doxing only shows what information is publicly available about you. This is only a fraction of what service and platform providers can see.

'''Methods used for doxing''' include exploring archives, images, government databases, phone directories and other publicly available information; querying privacy-protecting search engines like Startpage (https://startpage.com) or DuckDuckGo (https://duckduckgo.com); looking for a person's profile in specific services or on social networks; and searching for information in public forums and mailing lists. Doxing can also include looking up the public information on the owner of a website through a simple "whois search" (through websites like http://www.whois-search.com/ or similar).  

Remember,  if you are doxing other people, your research activities are leaving digital traces about you and your activities. Web services you use, and sites you visit may be collecting identifiable digital traces about you that you may not want them to have if this is a concern. So if you decide to dox others using the resources listed above, you may want to use tools that can anonymize the '''IP address''' that uniquely identifies where you are physically accessing the Internet.  

One of the best tools for anonymization is Tor via the '''Tor Browser''' (https://www.torproject.org/projects/torbrowser.html.en), which integrates Tor with the Firefox browser to make it easy to use, although users should remember to turn the built-in NoScript extension on, make sure Tor is working by checking your IP address, and keep Tor Browser updated. Tor does not guarantee anonymity (https://www.torproject.org/docs/faq.html.en#AmITotallyAnonymous) because it cannot protect people from not taking the steps listed above, nor from making simple privacy mistakes, such as using Tor Browser to enter your real name and other sensitive information into a web form.

Finally, if you find certain details about you online that are highly sensitive, or if you just want to systematically remove certain data traces about you as much as possible, there are things you can do. In the section below called ‘Regaining Control,’ there are tips and links about how you can alter or remove data you have created, as well as how you can ask other platforms and individuals to remove data that they’ve posted about you.

'''Further Readings:'''

* 'Preventing Doxing' by Crash Override Networkː (http://crashoverridenetwork.tumblr.com/post/108387569412/preventing-doxing)

* 'Countering Online Harassment Safety and Support Guide' by Feminist Frequencyː (https://onlinesafety.feministfrequency.com)

* 'So You’ve Been Doxed: A Guide to Best Practices' by Crash Override Networkː (http://crashoverridenetwork.tumblr.com/post/114270394687/so-youve-been-doxed-a-guide-to-best-practices)

* 'Smart Girl's Guide to Privacy' by Violet Blueː (https://www.nostarch.com/smartgirlsguide)

* Advice on doxing  harassers as a way to assess your level of potential risk from them: (https://modelviewculture.com/pieces/investigation-online-gathering-information-to-assess-risk)

* Tips on how to self-dox yourself (or to dox someone else): (https://lilithlela.cyberguerrilla.org/?page_id=93870)

* How Feminists can use the anonymity tool Tor, by Fembot Collectiveː (http://fembotcollective.org/blog/2015/05/06/toolkit-anonymous/)

==== <big>Social mapping</big> ====

While we have explained what steps you might take to explore the digital traces that make up your ‘digital shadow’, you will also need to enlarge this exploration to people you interact with online in order to gain a sense of what your online identity and various social networks 'look' like. Most of us have encountered challenging decisions about how to manage our personal, professional, and other ‘selves’ with our online accounts and identities. We may have only one identity that we use to connect with all our different networks, or we may have taken steps to ‘separate’ our identities online, even though this can entail creating and managing different accounts and the different ‘social domains’ we use them to interact with. This for instance has been an increasing safety issue for many activists, as their personal, professional, and activism networks can overlap in ways that can lead to greater levels of risk for our networks and us.

Everyone belongs to several social domains - your work or advocacy networks, your family networks, friends, colleagues, etc. Some networks may feel safer than others. For example, you may be more vigilant about what you share and how you share when it comes to your work or advocacy activities, but far less so when you interact with friends on a social networking platform like Facebook.  

If you use a single identity in all your domains, or if you always use your real name online, it becomes easier to gather information about you and to identify your vulnerabilities. For example, if you reveal in an online dating site that you like a particular kind of person, an attacker who wants to ruin your work or advocacy activities might trick you into sharing personal information with a fake profile designed according to your preferences, and then use any sensitive information you’ve shared with them through that fake account to blackmail you. In a generic everyday example, a prospective employer may find potentially embarrassing posts or information about you from your personal domains that you’d wish they wouldn’t have accessed.

These things, however, are made easier if your work identity, your personal identity, and your online dating profile can all be connected to the same person, and this is why separating our social domains can be useful. To separate those, it's helpful to first map them out and identify which ones could potentially expose you most.  

You can do this by thinking about your different activities and personal networks, and reflecting on each of these in order to better separate the domains that are sensitive from those that are not. You can do this by considering the data that you handle in the different realms of your life and ask yourself: What would happen if this particular data suddenly disappeared, or if it was seen, copied, and distributed by someone hostile towards me?  

As an example, the Polish computer security expert Joanna Rutkowska has developed a Linux distribution based on the concept of “security by isolation” called Qubes OS. In this system, each social domain is isolated in a separate virtual machine. The three basic domains Rutkowska identifies for herself are:  

* The '''work''' domainː This includes her work email, work-related PGP keys, reports, slides, papers, etc. She also has a less-trusted “work-pub” domain for things like accepting LinkedIn invites or downloading pictures for her presentations.  

* The '''personal''' domainː This includes her personal email and calendar, holiday photos, videos, etc. She has also added a special sub-domain to this called ‘very personal’, which she uses for encrypted communications with her partner.

* The '''untrusted (or red)''' domainː These are activities that she considers the least trustworthy and the highest risk. For her, this means browsing the web and using untrusted apps, and not sharing any sensitive or personally identifiable information.  

This example illustrates how Rutkowska uses isolation of her different social domains as a security strategy. She recognises that security measures can always be vulnerable, and so she reduces her risk by not having everything together in one place that can be targeted for attack. This example can be applied in other ways to your own social domains: by splitting up your social identities and domains, you no longer have a ‘single point of information’ for anyone trying to find out everything they can about you under your single ‘real name’ identity, and potentially using this single identity to attack you online. You’ll read more about ways you can design and manage different types of online identities online for your various ‘social domains’.

'''Further readingsː'''  

* You can find more details about Rutkowska's scheme here: (http://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html).

==== <big>Regaining control</big> ====

Finding out what data exists out there and can be accessed by others by self-doxing is an empowering first step. There are also measures you can take to control what content and metadata you give away. When you publish content on the Internet, it is always a good idea to ask yourself if what you are posting is public or personal and who could have access to it. Even if the information is connected to a public event and not to your personal life, the names you mention or the images you upload may contribute to a more comprehensive picture about who you are, what you are doing, where you are doing it and so on.  

This does not mean that you should silence yourself online, or not participate in public events, but just by taking some basic steps you can limit your risks. A useful way to decide which steps you should take to improve your privacy and security is to think about how you can increase the cost or amount of effort it would take someone who wants to surveille or attack you.  

'''Basic measures for reducing access to your content and data:'''

* When '''giving personal information to a web service''', make sure the service provides an '''encrypted connection''' for you to access it from (the url should begin with https://). You can use the browser add-on '''HTTPS Everywhere''' for Firefox, Chrome and Opera browsers, provided by the Electronic Frontier Foundation to help you force https connections with websites that offer encrypted connections (Seeː https://www.eff.org/https-everywhere).  

* If you use it correctly, '''Torbrowser will  mask your IP address''', thereby increasing your anonymity online (Seeː https://securityinabox.org/en/guide/anonymity-and-circumvention).

* You can install on Firefox, Chrome, Safari browsers some privacy add-ons like '''Privacy Badger''' which blocks spying ads and invisible trackers, '''Adblock Plus''' which block annoying ads or '''Ghostery''' which block third-party tracking scripts used to collect data on user behavior. Through your browser’s settings, you can also review and improve your privacy- and security-related settings, including deleting cookies on a regular basis (See: https://securityinabox.org/en/guide/firefox/windows and https://help.riseup.net/en/better-web-browsing).

* You should use '''strong and different passwords''' for each web service you use - if not, someone that intercepts or gains your main password could use it to access all your other accounts that use the same password (Seeː https://securityinabox.org/en/guide/passwords).

'''Mindfully publishing contentː'''

* When '''sharing personal details about your life''', often you can use '''private profiles''' that can only be accessed by selected contacts. When using these on commercial social networking platforms, you should be aware of r'''egular changes to the privacy policies''' of that platform. There have been cases where privacy settings have been changed, exposing pictures, content and conversations of private groups.

* When '''writing or posting images about public events''' online, you should ask yourself if the information you spread about individuals, places and other details could be used to identify and/or put someone at risk. It is always a good idea to first ask for '''permission''' to write about individuals and events, and perhaps also establish shared agreements about posting information about public events with fellow attendees and participants.

*  '''Faces in pictures can be blurred or obscured''' with an app called '''ObscuraCam''', a free camera application for Android devices. (https://guardianproject.info/apps/obscuracam)  

'''Reducing your metadata:'''

* You can '''switch off the GPS tracker''' in your phone or camera. You can also limit various apps’ access to your location data, contacts, and pictures in your phone settings. You can also read more about  alternative tools that offer encrypted mobile communication on mobiles (https://securityinabox.org/en/guide/smartphones) such as Text Secure for text messaging (https://whispersystems.org/#) and Ostel (https://ostel.co/).

* When '''registering a device''' or software such as Microsoft Office, Libre Office, Adobe Acrobat and others, you don't need to use your real name. This prevents the metadata created when using this device or software from being connected to your name.  

* When '''publishing content online''' you can change files from ones that contain a lot of metadata (such as .doc and .jpeg) to ones that use less metadata (such as .txt and .png), or you can use plain text.

*  You can use '''tools to remove metadata from certain files'''. For images there is '''Metanull''' for Windows (https://securityinabox.org/en/lgbti-africa/metanull/windows). For '''PDFs''', Windows or MAC OSX users can use programs such as '''Adobe Acrobat XI Pro''' (for which a trial version is available). GNU/Linux users can use '''PDF MOD''', a free and open source tool. (Note: this tool  doesn’t remove the creation or modification timestamp, and it also doesn’t remove the information about the type of device used to create the PDF.) You can also review MAT (Metadata Anonymisation Toolkit), a toolbox to anonymize/remove metadata used by TAILS for instance. For a full guide to '''removing metadata from different file formats''', see Tactical Tech's resource: https://securityinabox.org/en/lgbti-mena/remove-metadata.  

'''Blocking access to content and deleting accountsː'''  

* '''Temporarily blocking content from Google Search results:''' (https://support.google.com/webmasters/answer/1663419?hl=en&lr=all&rd=2) describes how to use the Temporary URL Blocking tool to block search results for websites. This does not actually remove content, but it blocks older (and potentially more sensitive) content from search results until you can make updates to your website(s).  

* The '''Suicide Machineː''' (http://suicidemachine.org) is a tool that facilitates the process of deleting social media profiles. This tool was forced to stop deleting Facebook accounts, but instructions on how to do this can be found here: (https://www.facebook.com/help/224562897555674).

* '''AccountKillerː''' (https://www.accountkiller.com) has  instructions on how to remove accounts or public profiles for most popular websites and social networking services.

* '''JustDelete Meː''' (http://justdelete.me) is a directory of direct links to delete accounts from web services and social networking services.

== <big>Creating and managing identities online</big> ==

Most of us have encountered challenging decisions about how to manage our personal, professional, and other ‘selves’ with our online accounts and identities. We might have only one identity that we use to connect with all our different networks, or we might have taken steps to ‘separate’ our identities online, even though this can entail creating and managing different accounts and the different ‘social domains’ we use to interact with. This has been an increasing safety issue for many activists, as their personal, professional, and activism networks can overlap in ways that can lead to greater levels of risk for themselves and their networks.  

Usually, most people who separate how they interact with their different social domains (especially work and personal life) still use the same identity, which is generally either their ‘real name’, or a 'pseudonym' (more on that below). But with the nature of the work we do as women human rights defenders (WHRDs) or as feminists plus the increased risk of attacks and harassment we can have simply due to our gender or sexual orientation, there are other options to consider and explore. Targeting, harassment, and gender-based violence online represents tremendous and ever-increasing problems that remain almost entirely unaddressed by those who control many of the online spaces we use. Currently, women, trans* and other marginalized individuals struggle to find safe spaces online, as governments, online communities, and both corporate and non-corporate services and websites stumble in their attempts to adequately address what have become hotly contested ‘spaces’ and ‘cultures’ online.   

In this section, we’ll continue the process of reflecting on what our current online identity or identities are, what social domains we use those identities to communicate with, and how we may adjust and re-invent our online identities and activities in ways that are safer and more efficient for the work we do online. We’ll describe the different types of online identities, how they are used, and the trade-offs of using one over another. We’ll then dive into how to create new online identities, how to create believable pseudonyms and ‘back stories’ on platforms that require ‘real names’, the ins and outs of managing multiple identities, and how you can use certain tools, platforms, and devices to complement the management of your identities online.

=== Using your 'real identity' vs. other options ===

Once you have identified your different social domains and the activities and networks that go with them, you need to think about how to improve the ways you interact with those.  

The first question to consider is whether or not you want to differentiate your identities according to the social domains you’ve identified for yourself, or if you'd rather stick to your official name and true face for each of them. There is no ‘right’ or unique answer to this, but this process and the consideration of your options will illuminate the strengths and weaknesses of how you currently operate online. All these are potential decisions that need to be thought through carefully, and speaking about these decisions and trade-offs with friends who do similar work can be immensely helpful. You may want to keep your work connected to your legal or "real" identity because this gives it legitimacy, or perhaps you are so well established that reversing this would be problematic for various reasons. Or you may think that your activism should be '''anonymous''' (more on this below).  

Let’s use an example of a journalist considering these issues. She may have more credibility and more job opportunities if she uses her real identity for her writing. Or she may decide to keep her real name confidential and use a nickname (or ‘'''pseudonym'''’) for her work, which means taking various precautions so  no one can connect the two spheres together. This may mean she has to work harder to build her credibility as a journalist, and some potential employers may not want (or be able) to pay her for her work without knowing her real name, but separating her online journalism identity from her real name and identity is important and valuable enough for her to work a little harder.

A second example that illustrates these trade-offs is an activist considering her choices. If she wants to use a pseudonym instead of her real name, she should consider that she may be showing her face as part of her activism-related activities in the real world (such as speaking at conferences, participating in demonstrations, or attending small events). Can she keep all images of her doing her activism-related work offline? If not, her online pseudonym will be linked to her face in online images, and her face can be then also be linked to her real name in other social domains, such as her personal account on social media. This could eventually ‘unmask’ her online activist identity, defeating the reasons why she originally chose to use a pseudonym.

It also becomes increasingly difficult to understand and remain aware of all the kinds of data and metadata (‘digital traces’) we create when using many apps and functionalities via multiple devices—especially mobile phones and the emerging number of networked devices that we describe as the ‘'''Internet of Things'''’. This has made various types of online identities much more challenging to create and maintain effectively and safely without revealing identifiable information about ourselves and our networks.  

Considering how potential online identities can improve your safety (and the safety of those connected to you personally and professionally), is crucial to accurately assessing your risks, as well as the technical skills and abilities you would need to use various types of online identities safely. You also need to think about which kind of identity you’d use in a given context. The following questions illustrate elements you should be considering when evaluating alternate online identities:  

* Would my safety, job or livelihood be at risk if my real identity were known?

* Would my mental health or stability be affected if my participation in certain activities were known?

* Would my family or other loved ones be harmed in any way if my real identity became known?

* Am I able and willing to maintain separate identities safely?

These questions illustrate elements of basic risk assessment processes that you should apply when thinking about how your online identity (or identities) impact—or are affected by—your digital security and privacy. Assessing your risk helps to clarify your options and needs when considering different strategies for separating your identities online. These range from full transparency to full anonymity, and include as many separate identities as you think are needed and possible for you to maintain and do your work safely. Because of the risks involved with WHRDs’ work, we recommend doing as in-depth risk assessment as you’re able, and to seek assistance if you need it.  

'''Further readings:'''

* Tactical Tech's guide to risk assessment: (https://securityinabox.org/en/lgbti-mena/security-risk)

* Electronic Frontier Foundation's guide to threat modeling: (https://ssd.eff.org/en/module/introduction-threat-modeling)

==== "Real" names ====

Author Kate Harding talks about her decision to start writing under her real name, dismissing the recommendations that are generally given to bloggers to follow practices like 'writing under a pseudonym, making that pseudonym male or gender-neutral if you’re one of them lady bloggers... masking one’s personal information, being circumspect about publishing identifying details, and not writing anything that might inflame the crazies'. Instead of putting responsibility on women, Harding says, problems of harassment should be handled by society as a whole, including men. However, she also acknowledges that the decision can be a dangerous one.

For example the project Geek Feminism reveals how certain groups of people are disadvantaged by policies that require individuals to use their real or legal names. These include women, queers, trans* persons, differently-abled persons, children and parents. The costs to individuals from these groups when they have a public profile attached to their real name can range from discrimination (in employment or services) to arrest, imprisonment or execution in some contexts. At the Human Rights Council, APC together with the International Gay and Lesbian Human Rights Commission and the International Lesbian and Gay Association delivered a joint statement highlighting the importance of encryption and anonymity for people who face discrimination and persecution based on their sexual orientation and gender identityː (https://www.apc.org/en/node/20587/)

'''Further readings:'''

* Kate Harding talks about her decision to start writing under her real nameː (http://kateharding.net/2007/04/14/on-being-a-no-name-blogger-using-her-real-name/)

* How Facebook's real name policy affects LGBTQ persons: (https://www.eff.org/deeplinks/2014/09/facebooks-real-name-policy-can-cause-real-world-harm-lgbtq-community)

* For a comprehensive list of which groups of people are affected (and how they are affected), see Geek Wiki Feminismː(http://geekfeminism.wikia.com/wiki/Who_is_harmed_by_a_%22Real_Names%22_policy%3F)  

==== Anonymity ====

Anonymity is the approach of keeping your identity and any uniquely identifying details about you completely hidden. This can mean attempting to keep your real identity private and separate from the work, activism you do and/or opinions you voice. On anonymity, Vani, a human rights activist, writes: “I am a regular social network user. I voice my opinions on a range of topics. But I remain faceless and nameless” (http://internetdemocracy.in/media/).

Anonymity may be a good choice for certain contexts and activities if you don't need to gain other people's trust, if there are few or no people you can trust, or when you don't want to expose yourself and others in your life to increased risk. Similar to other options below, it requires being mindful of the ‘digital traces’ you create, as we discussed above, it requires dedication and not making simple mistakes. For example, commitment to anonymity means you have to be very disciplined about not revealing your ‘real IP address’, similar to not revealing your ‘real name’. For this, '''Tor Browser''' and '''trusted VPNs''' can be critical everyday tools you use.

Anonymity may also be a good option from time to time when you are doing certain online activities that are more sensitive than other work and online activities you do under other types of identities. For example, you may want to remain anonymous when researching or participating in message boards about sensitive health issues, or when discussing censored content or highly political issues in online environments that are possibly monitored.  

Anonymity can also mean using elements of other types of online identities. If you want to communicate with someone that you don’t entirely trust or you don't want to reveal your ‘real’ identity to (for example, someone you met on the sensitive health issue forum in the example above), you may want to set up a one-time account using a pseudonym to communicate with them over chat or email. When operating anonymously online, you may also want to use one-time pseudonyms to comment on a blog post or news site, or to establish a one-time nickname to identify yourself in a single chat session.

But total anonymity can be difficult to maintain, especially as you create larger amounts of content over long periods of time. The odds increase that you (and others who know your identity) may make ‘mistakes’ and reveal identifying ‘digital traces’ about you through your content or metadata that uniquely identifies you. Additionally, anonymity can also be risky in countries where it’s automatically considered a ‘red flag’ by authorities that may think an anonymous user is trying to hide something or doing something wrong. Anonymity can also be lonely and isolating, which leads one blogger to question: “Can you have a network to protect you and also be anonymous at the same time? Would visibility be a better strategy for you?”.

When you adopt anonymity as a strategy you may use pseudonyms, but these should not be used across different networks or social domains, and some may only be used once and then discarded. Because of this, anonymity differs from persistent pseudonymity.  

'''Further Readings:'''  

* The anonymity decision for bloggers: (https://advocacy.globalvoicesonline.org/2015/05/01/to-be-or-not-to-be-anonymous-how-should-bloggers-decide/)  

* How the real identity of the blogger behind the Damascus Gay Girl blog was revealed by online investigation: (http://electronicintifada.net/blogs/ali-abunimah/new-evidence-about-amina-gay-girl-damascus-hoax)

* How to Remove Your Online Identity for achieving full Anonymity on the Internet: (http://null-byte.wonderhowto.com/how-to/remove-your-online-identity-ultimate-guide-anonymity-and-security-internet-0131741/)

==== Persistent Pseudonymity ====

Persistent pseudonymity involves using a fictitious name consistently over a period of time. A pseudonym may also be referred to as a ‘nickname’, a ‘handle’ or a '''moniker'''. As discussed above, there is a myriad of reasons why you might want to use a name other than the one you were born with. Remember that using a pseudonym means you still have to be very careful about keeping your pseudonymous work separate from your personal life, which means paying close attention to potentially identifying digital traces created under that pseudonym (such as a photo that can be traced to you, or an email account or forum comment that you made with your real name can be linked with your pseudonym, or revealing your ‘real’ IP address the same way you could reveal your ‘real name’ by not masking it using Tor Broswer, a VPN, or other tools). For an excellent example of how a pseudonymous blogger’s ‘real identity’ was revealed using digital traces, read the ‘Gay Girl in Damascus’ story above. All of this means you have to be really sure this is something you want to do and that you are ready to make the effort required. If so, here's some things to consider.

A pseudonym can be name-shaped (e.g., "Jane Doe") or not (think of some Twitter handles you’ve seen that are thematic, symbolic, or nonsensical phrases or words). Often, you will have complete freedom to create pseudonyms, but there are also services that police and shut down accounts with pseudonymous or anonymous identities. At the time of writing, the most well-known example of this is Facebook, which requires users to use their ‘authentic identity’ (or ‘real name’), which almost always means your legal name, or the name by which you are commonly known (such as a nickname).   

This story (http://thinkprogress.org/lgbt/2015/07/03/3676827/facebook-transgender-real-name-policy/) illustrates how even using your legal name can be incredibly difficult on sites banning all but ‘real names’. Facebook’s policy in particular has also caused many users to lose their Facebook accounts (http://www.theguardian.com/commentisfree/2015/jun/03/facebook-real-name-policy-hurts-people-creates-new-digital-divide), including feminist groups, trans* persons and drag kings and queens known for their pseudonyms rather than their legal names. If you choose to use a pseudonym on some social networking services, it is important to understand that you can be reported for using a "fake name," and possibly have your account deleted. A strategy for avoiding that can be to use a name-shaped pseudonym so that your account is not automatically picked out as problematic by services like Facebook.  

Persistent pseudonymity can also offer visibility in a way that anonymity cannot, which allows you and your work to gain an online reputation and following over time, as well as the ability to network with others. Successfully establishing an online reputation and connections with online networks will still depend on members of trust-based online communities deciding whether you are worthy of their trust, which can make your online reputation a crucial element of your online pseudonymous identity.  

You may even choose to reveal your legal identity or ‘real name’ to some people within trust-based networks, or not. Any potential decision to connect your pseudonym and the online reputation associated with it to your ‘real name’ is a highly personal choice made according to your needs and context.  

'''Further readings:'''  

But be aware that the ‘power of the crowd’ can also be the mob mentality’, or even the ‘tyranny of structureleness’ (in reference to Jo Freeman workː http://www.jofreeman.com/joreen/tyranny.htm).  The collective may choose to do things that you don’t agree with, or things that will put you at unacceptable levels of risk. In some cases, members of collectives have been prosecuted for illegal acts even if they played low-level roles in the collective, and simply being a member of a collective can increase the level of scrutiny, surveillance, and risks you experience. So if you are considering acting as a collective identity, choose wisely and do your research before joining.

'''Some examples of collective identities:'''

'''Captain Swing:''' the identity used by farm workers in protest letters written during the English Swing Riots in 1830 (https://en.wikipedia.org/wiki/Captain_Swing)

'''Luther Blisset:''' this was originally the name of an Italian footballer that became adopted and used by many artists and activists for various actions and even a series of books (https://en.wikipedia.org/wiki/Luther_Blissett_%28nom_de_plume%29)

'''Guerrilla Girls:''' an anonymous group of feminist and female artists devoted to fighting sexism and racism within the art world (http://guerrillagirls.com/)

'''Netochka Nezvanovaː''' may be the name of a group of people, or it may actually be the pseudonym of a single woman. (The name itself means ‘Nameless Nobody’ in Russian, from a novel by Fyodor Dostoevsky). Netochka is the ‘human face’ of a software tool kit used to manipulate digital video in real time, but her activities and actions add to the reputation and mystique of the identity. Netochka used to give the interviews to promote the software, but she was frequently represented by different women when she showed up in person (http://www.salon.com/2002/03/01/netochka/)  

'''Kolena Lailaː''' was started by a group of young women bloggers in Egypt in 2006. The initiative devotes one day a year to mobilizing all Arab woman bloggers to speak out on different forms of oppressions they face; Kolena Laila means ‘We are all Laila’, the protagonist of ‘The Open Door,’ a novel by Latifa El Zayyat )(http://yfa.awid.org/2010/04/blogging-initiative-amplifies-voices-of-young-arab-women/)

'''Further readings:'''

* Gabriella Coleman's 'Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous' is an anthropological recounting of the glories and disasters of Anonymousː (https://boingboing.net/2014/11/20/hacker-hoaxer-whistleblower.html)

* 'The Tyranny of Structurelessness' is an influential essay by American feminist Jo Freeman inspired by her experiences in a 1960s women's liberation group that concerns power relations inside collectivesː (http://www.jofreeman.com/joreen/tyranny.htm)

* Guerilla girls website contains useful resources about women in artː (http://www.guerrillagirls.com/info/index.shtml)

==== Comparing strategies ====

You should now know more about different types of online identities, what they offer, how they overlap, and the trade-offs involved in using them. You’ve probably thought about how different types of online identities would work well for communicating with others in different ways, and are pondering the steps you would take towards different strategies.

But, as mentioned above, it is crucial to understand the benefits and drawbacks for you and your specific needs and situation in terms of your safety, the requirements of implementing a specific type of identity, and the technical abilities that identity requires for your specific level of risk. Since the community this was originally written for was women and trans* human rights defenders and activists, there may be a certain level of increased risk that would require a relatively strong baseline of technical knowledge and skills in order to safely create and manage these types of online identities. For others, the steps and strategies may be built more around personal preferences and decisions.

Since this initial content in the manual is avoiding hands-on technical advice and ‘deep dives’ into tools and digital systems, it’s important to remember that you will probably need to know how to use a range of security and privacy tools well (for example, Tor Browser), since employing many of these identities require fairly advanced knowledge, awareness, and skills to avoid making mistakes that could reveal enough data to expose one’s true identity and even the identity of others.  

Because of these issues, we recommend to read and review our [[Complete_manual#Establishing_a_baseline_of_privacy_and_security_knowledge|'Establishing a baseline of privacy and security knowledge']].

To use these identities well enough to withstand surveillance and monitoring in hostile environments requires a certain level of technical skills and knowledge because of the number of variables, technologies, systems, and actors involved. This is really about making good decisions about the threats you are facing or are likely to face in the future. Choosing to limit your use to certain platforms over others could help with many of the challenges, but not all of them. We suggest when possible talking with others who have used these types of identities in similarly high-risk or hostile environments as part of your research before choosing to use one or more of them unless you are simply exploring and trying a type of identity in a safe and innocuous context, which is an excellent way to gain practice and a sense of what each of these identities entails.

This can seem overwhelming. One thing that may help is to consider what kind of ‘worse case scenarios’ you could handle if one of your online identities became compromised and your ‘real identity’ was revealed. For some people it could have very serious repercussions that could cause harm or prevent them from operating. For others, it may be problematic, but it would be something that they could absorb and move on from, and no one would suffer serious harm. This illustrates how much these decisions depend on each individual, as well as how they decide to use these identities to interact with their various social domains, including the activities they do as WHRD and trans* activists.

''The pros and cons of the various identity options described above:''

!

!'''Risk'''

!'''Reputation'''

!'''Effort'''

|'''Real Name'''

|'''Total Anonymity'''

|'''Persistent Pseudonimity'''

|'''Collective Identity'''

'''Real name'''

*''Risk'': Using your "real world" identity online means you are easily identifiable by family members, colleagues, and others, and your activities can be linked back to your identity.

*''Reputation'': Others can easily identify you, thus gaining reputation and trust is easier.  

*''Effort'': It requires little effort.

'''Total anonymity '''

*''Risk:'' It can be beneficial at times, but also be very difficult to maintain. Choose this option carefully.

*''Reputation'': There are few opportunities to network with others thus to gain trust and reputation.

*''Effort'': Intensive as it requires considerable caution and knowledge. It will probably require the use of anonymisation tools (for example '''Tor''' or '''TAILS''')

'''Persistent pseudonymity'''

*''Risk'': Pseudonyms could be linked to your real world identity.

*''Reputation'': A persistent pseudonym that others can use to identify you across platforms is a good way to gain reputation and trust.

*''Effort'': Maintenance requires some effort, particularly if you are also using your real name elsewhere.

'''Collective Identity'''

*''Risk'': Possible exposure of your real world identity by other people's actions in the group.

*''Reputation'': While not a way to gain individual reputation, you can still benefit from the reputation of the collective.                                                 

*''Effort'': Although secure communications are still important, it requires less effort than total anonymity.

== <big>Creating a new online identity</big> ==

Once something is on the Internet it will almost always persist online and on private servers in some form. You may think that deleting certain sensitive data from social networking platforms and web services are enough to protect yourself, but remember that metadata cannot be deleted (or found) as easily. Many companies delete your account - for your view- but may keep the data on their servers for some time depending on their policies and local laws. And using just one identity throughout your whole life—in all your work and personal domains—creates a bulk of information that makes it easier to profile (or ‘dox’) you.  

One option to avoid this is to leave an old identity behind and create a new one, or (as discussed above) several new ones for each of your social domains. You might also choose to still use your real identity in some areas, and your new alternative identities in others.  

Even if you don't feel an explicit need to have more than one online identity right now, it is worth familiarising yourself with the process. That way, if you get trolled or harassed online in the future and need to create a new identity, it will be easier to do. As with all security and privacy tactics and tools, you will learn better when you are not facing a direct threat, especially one attacking your online identity, reputation or even, your physical integrity. The effects of distress and fatigue affect our ability to engage with the systematic processes of risk analysis, security planning, and skill-building.  

Besides all of this, creating new online identities can be really fun and is an essential part of how the Internet began: as a vast and endless new playground to reinvent one’s self and be whomever we dreamt of being. Whilst it is changing, it is a feature we should try to hold on to. Once you have decided that you want to experiment with multiple identities and have chosen what kind of identity (or identities) you want to create, you may want to take into account the following recommendations:

* You should select your social contacts for each one carefully, and '''avoid sharing contacts with other identities you use''' for different activities. This effectively creates separate social domains, with separate accounts, email addresses, browser profiles, apps, and if possible, even devices.

* Your '''various identities should not be linked to each other''', or to your real identity. Remember that some of these connections can be tenuous as for example when signing up for a new pseudonymous email account using your real phone number, or using a persistent pseudonym when creating a one time use disposable email.

* Creating '''additional disposable identities''' can be useful, as they can be discarded easily if compromised. These can also be created for new acquaintances (when appropriate) as introductory profiles to get to know somebody before you include them in a more trusted network.

==== Creating names and life stories ====

As discussed at length above, many platforms have ‘real name’ policies, so if you want to use commercial social networking platforms under a false name, it is better to use a credible name and surname rather than more ‘imaginative’ ones that seem fake. Or you may want to use the information in this section to create accounts you only use once, or devices that you only use to create a fake identity.

Once you have decided on a name, a surname, and a username for your virtual persona, you should do thorough research—perhaps also using doxing tools and techniques—to find out if someone else is already using that name. After all, if you wish to develop your own reputation, you don’t want to be confused with someone else, especially if they don’t share your views of the world or if your activities might put them at risk! Or you could use the opposite strategy of intentionally using a very common name with hundreds of instances online.

Then you need to create a story for this virtual persona, because if it comes with a story it makes it a lot easier to maintain. This can be really fun and challenging. You can invent a new story if you feel particularly inspired, or base your story on a “known” person’s story, a super-heroine, a fictional character from your favorite novel, or adopt a “collective identity”. In any case, when you create an identity you should conceive of a whole virtual persona, an avatar that needs to be nurtured and developed in order to become credible.  

'''Relevant links:'''

* '''Fakena.me:''' (https://fakena.me) is a privacy-oriented '"fake name generator" that will give you all the fake info you need to set up an account (fake name, birth date, US only address, username and password) as well as a link to an associated guerillamail mailbox.  

==== Credible personas ====

A virtual persona or identity can't be just a name with an email address and a series of web accounts. If you keep all your core identifying traits in all your personas—such as your gender, profession, preferences, or even the unique way you write and the words you use—it might be possible eventually for a dedicated person to connect the dots and link your pseudonymous personas with your real identity.  

* '''Work:'''  Your persona should have a job that is different from yours, but not so different that you don’t know anything about that field. Also, you may want to vary where you work in terms of city and country.

*'''Skills and interests:''' Similar considerations should be made to select your persona's skills and the main topics they focus on and write about.  

*'''Psychological attitude:''' A good way to give your persona depth is by creating some "weak spots" which are not the same as your own. So when the persona gets attacked, you can laugh about it and not experience harm. For example if you have a good sense of humour, try impersonating a humourless person!  

* '''Linguistic fingerprint:''' Although more advanced, it’s possible to be identifiable through a "stylometric analysis" that can identify the author of a particular text if they have enough samples of their writing. This is not used by many people of course, but if you’re concerned about this, analyse how you write, what kind of typos you tend to make (you can utilize a spell-checker to help with this), and what kind of phrases and sentence structures you tend to use. You can complicate any potential analysis by using different writing styles that could involve the words you use, the structure of your sentences, unusual use of capitol or lowercase letters, and various misspellings you typically wouldn’t make. If you have a number of personas, you could potentially create a simple rule for how each writes, and keep track by saving them with your passwords and login information for each persona’s account(s). This of course is a technique for the dedicated!

In any case, you should always remember that on the Internet, each of your identities—even those connected to your real name—is a “virtual” identity, and it is always better to decide what character traits you want to expose in each of them. Creating a somewhat fictional character may even be a good idea for your “real” online identity in some cases.  

'''Relevant links:'''

* Tips for creating a rounded character for your identities: (/https://lilithlela.cyberguerrilla.org/?page_id=94049)

* Helpful tips for inventing a new identity: (http://anonymissexpress.tumblr.com/post/117939311235/you-may-have-noticed)  

* Artist Curtis Wallen's experience of creating a new online identity: (http://www.theatlantic.com/technology/archive/2014/07/how-to-invent-a-person-online/374837/)

* Tips for building your online credibility: (https://gigaom.com/2008/10/30/building-your-online-credibility/)

* On the Internet nobody knows you are a dog: (https://en.wikipedia.org/wiki/On_the_Internet%2C_nobody_knows_you%27re_a_dog)

* An oral history of the first cyberfeminists: (http://motherboard.vice.com/read/an-oral-history-of-the-first-cyberfeminists-vns-matrix)

== <big>Managing several identities</big> ==

Maintaining multiple identities does take some work, but like most of these practices, it mostly requires some curiosity, patience and attention. After a while, it will become habitual like everything else we do online (think of how complex our social networking habits are!) The main point is to always stay vigilant in order to keep your identities separated, or else they will very quickly begin to mix with one another. As a start, you can keep notes on your identities to help you to avoid any awkward situations where you confuse one with another (but do think carefully about where you host or keep those notes!). There are also technical things you can do that are detailed below. In any case, take into account that those recommendations focus on identity management using desktop computers and may not always apply to the same activities using mobiles devices. Sadly, mobile devices have metadata and security concerns that are harder to control and manage, which is part of why they are consistently described as inherently insecure devices.

* Create '''different browser profiles''' so that your browsing habits are captured under different identities, on Firefox (https://developer.mozilla.org/en-US/docs/Mozilla/Multiple_Firefox_Profiles and https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles) or Google Chrome (https://support.google.com/chrome/answer/2364824)  

* When creating a new email account or social media account for an identity, it is a good idea to '''connect to the server’s website using Tor Browser''' or '''Orbot''' (for mobile devicesː  https://securityinabox.org/en/guide/orbot/android). If a contact email address is required, consider using a disposable email address, one that you only use for that account. But be mindful that the email provider you choose doesn’t also collect and reveal the connections between that new ‘disposable’ email account and your real identity – for example, this can be almost impossible when trying to create a disposable Gmail account via a Chrome browser when one of your main ‘real identity’ email accounts is already linked to it. Consider using other email providers you usually don’t use for your ‘real identity’ email accounts.

* Write up and '''establish ‘basic house cleaning’ steps''' you take as you ‘enter in and out’ of the accounts for your different identities. This includes logging out of accounts, erasing cookies, not having your browser save your passwords, etc. Obviously you also need to manage different passwords for each one of those accounts so we strongly recommend you to have a look at tools such as '''Keepass''' (https://www.securityinabox.org/en/guide/keepass/windows) for instance which work for all OS.

* If you have the resources and motivation you can '''separate your identities per device or operating system'''. This can include using virtual machines for instance, as explained at the end of this chapter.  This option can be an incredibly useful way to use and manage your various accounts.

Whichever route you choose, try to make the processes as routine as possible so that it becomes something that you can manage as part of your workflow.

==== Disposable email addresses ====

For some activities and social domains you need to manage rounded personas, in order to gain a strong reputation and trust from other members of the community. In other cases, though, all you need is a ‘disposable’ email address for opening an account in a platform you don’t trust because of potential tracking, monitoring and/or spamming. Using disposable email accounts will reduce the number of traces connected to the main email address(es) you use for your work or personal life, and have the bonus feature of  minimising the amount of spam in those accounts. Below are some services that can help you set up disposable accounts and addresses:  

'''Relevant links:'''  

* While not every mail service allows users to create mail aliases, this service is offered to every mail user of '''Riseup''' (https://we.riseup.net) and '''Autistici/Inventati '''(https://www.autistici.org).

* Does it provide an '''encrypted connection (https) for all uses''' of the site, rather than just during login? Are there any problems related to the website’s encryption? (see previous chapter on regaining control)

* According to the platform's '''End User Licence Agreement (EULA), Privacy Policy and/or Data Use Policy''', how is your content and personal data handled? With whom is it shared or possibly sold to?

Now when you think about crafting a separate identity and letting it out on commercial social networking platforms, there are additional precautions to take:

* It is important to '''not expose yourself by revealing your ‘real’ IP address location''', so we recommend using tools that mask your IP address—such as Tor Browser or a trusted VPN—to connect to those platforms. You can check the list of services blocking Tor hereː (https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor).

* Have fun with '''the profile information you provide''' but remember that this information is publicly available, so think about the message you want to convey with it.  

* Make sure '''your contacts do not overlap with your other identities''', and your different identities don't "follow" one another. It is particularly not a good idea to follow your pseudonymous personas with your real identity. If someone is looking to unmask one of these personas, the first thing they will look for is who the account follows, and who follows the account. For the same reason, we should avoid reposting posts or other content published by one account with another account.

* To '''make your identities look like different people''', you can publish from your various accounts at different times of the day. Some social networking platforms, like Facebook, allow users to schedule the publication time of their posts.  

* It can be a good idea to follow, from your pseudonymous profiles, other people who might reasonably be considered the real owners of that profile. To '''further distance your real identity from your pseudonymous identities''', you can also write (and hashtag on Twitter) posts under your pseudonymous profiles about events that you are not attending, especially if they are taking place far away from you. It can also be fun to publish and then delete posts that look like you have exposed your identity, so as to further confuse anyone who may try to unmask you.

* If you are using a GPS-enabled phone, most '''social networking platforms will display your location where they can'''. This function is generally provided when you interact with the platform using a GPS-enabled phone, but the network your computer is connected to may also provide location data. It's always a good idea to '''double-check your settings''' - particularly on photo and video sharing sites to make sure your physical location and other metadata is not being collected and shared with media you share or post online.

* If you '''access social networking platforms via mobile apps''', it is better to use a different app for each separate account, so as not to post something to the wrong account by mistake. There are several apps that can be used to carefully manage your social networking platforms. It is, however, a good idea to use a different one for each identity, to reduce the risk of giving away your real identity.

'''Relevant links:'''

* '''Terms of Service; Didn’t Read:''' (https://tosdr.org) provides an application in order to get summary in "human language" of the Terms of Service of many popular social networking platforms and other websites.

* Tools for '''scheduling Facebook''' posts: (https://www.facebook.com/help/389849807718635)

* Tools for '''scheduling posts on Twitter''' and other platforms: Buffer (https://buffer.com) and Postcron (https://postcron.com)

'''Further readings:'''

*  Tactical Tech analysis of terms of services: (https://myshadow.org/lost-in-small-print) provides a collection of companies' privacy policies, edited to help you parse through their small print.  

* Facebook action by Women, action and the media: (http://www.womenactionmedia.org/facebookaction/)

* 6 Tips for Protecting Your Communications From Prying Eyesː (https://www.propublica.org/article/six-tips-for-protecting-your-communications-from-prying-eyes)

== <big>A different machine for each identity</big> ==

There are various approaches to digital security, but one of the most realistic approaches is '''security by isolation''', which assumes that all security measures have their holes and therefore focuses on harm reduction by preventing possible attackers from accessing the ‘whole system’ that needs to be secured. This is what underlies the strategy of using multiple online identities in isolation from each other—it takes a single target that is difficult to defend (your ‘real identity’) and turns it into multiple targets (your various online identities) —if done correctly—. It can be effective, but this all depends on your situation and the type and depth of security you are trying to create. Ultimately this depends on who you really think your "adversary" is and what kind of access you think they have. How you appear to outsiders online, is very different to how you appear to someone who has indirect access to you devices or the services you use. If you are working in an environment where you want greater control over your devices and services, one technique is to extend this strategy from separate and isolated online personas (and the online accounts you use them with to communicate with distinct social domains) to the devices you use. Most of us use the same operating system on the same device to create, use and manage all our online identities, since we usually only have access to one computer and one mobile phone. Because of the way we are uniquely ‘fingerprinted’ online via our browsers and apps (see for instance EFF’s Panopticlickː https://panopticlick.eff.org/), we have to take extra steps to ‘appear’ different when we use our different online identities. One of the ways we do this is by varying the browsers we use, and creating and saving separate browser profiles that we use for each online identity.  

But by always using the same device (usually a computer) and operating system on that device, you unavoidably increase the chances of making mistakes, no matter how carefully you separate your profiles and do everything ‘right’. For example, you may accidentally sign into a pseudonymous account using the browser profile you have assigned to your "real" identity, which leaves distinct metadata behind that seems unusual compared to the browser profile you usually use for that account, and can even inescapably link that pseudonymous account to your real account if someone is paying very close attention and is capturing your browser data when you log in. You could also get infected by malware that enables your attacker to monitor everything you do online, including all your activities using your many carefully crafted and managed identities.  

To mitigate these risks (which are very common human errors—nobody’s perfect!), you can use a different device for each of your online accounts (and their respective social domains), which reduces the possible harm caused by potential spyware or human error. Most of us don't have those kind of resources, however. Therefore, an inexpensive (and usually free) option is to use a different operating system on your one main computer by using a GNU/Linux live distribution like Tails or by creating ‘virtual machines’ that run ‘inside’ your computer’s main operating system. A virtual machine (VM) can be described as a simulated computer with its own operating system, which runs as software on your physical computer. You can think of a VM as a computer within a computer. Using VMs can be useful for a wide range of things, including anonymisation, sharing machines with other people, or for opening untrusted and potentially harmful attachments ‘isolated’ in the VM from your main operating system in order to avoid a potential malware infection of your entire system.  

The three tools proposed here — '''Tails, Whonix and Qubes OS''' — provide you the additional protection of separate operating systems for managing your alternate identities without having to use multiple computers, and can be incredibly powerful tools to make sure you don’t reveal your true identity when you’re using your other online identities in isolation from each other. Even better is that these solutions (detailed more below) are free and open-source Linux distributions that have been designed to maximise the privacy and security of its users.  

'''Tails, or The Amnesic Incognito Live System: ''' (https://tails.boum.org/) is a live operating system designed to help you use the Internet anonymously and evade censorship. It can be run on almost any computer directly from a DVD, USB stick, or SD card, and then be shut down without leaving traces on your computer (or other devices you use). It forces all the computer’s outgoing connections to go through Tor, and blocks attempts to make direct, non-anonymous connections to your computer. Using Tails is pretty easy, although some of what you can do (and the apps you can use) are limited out of necessity; despite this, you can do everything you need in order to use and maintain your online identities, including your ‘real’ identity, although you cannot access the content on your computer that you’ve stored there (such as photos and videos). You can still access your email accounts, and transfer media over to be used in Tails via USB stick, SD card, or other portable media.  

* System requirements: Tails should work on any computer manufactured after 2005 (https://tails.boum.org/doc/about/requirements/index.en.html)

* Documentation: https://tails.boum.org/doc/index.en.html

'''Whonix:''' (https://www.whonix.org) is an operating system created to run in a virtual machine that is designed to protect your anonymity, privacy, and security by helping you to use your applications anonymously. A web browser, IRC client, word processor and other tools come pre-configured with security in mind. Whonix is a relatively recent project and the community using it is still rather small.  

* System requirements: You will need a good machine where you can run Virtualbox (https://www.virtualbox.org) in order to install Whonix (https://www.whonix.org/wiki/System_Requirements).

* Documentation: (https://www.whonix.org/wiki/Documentation)

'''Qubes:''' (https://www.qubes-os.org) keeps the things you do on your computer securely isolated in different virtual machines so that if one VM gets compromised, nothing else will be affected. This way, you can do everything on a single physical computer without having to worry that one successful cyberattack harms your whole system, potentially revealing all the connections among your various identities. Qubes OS is a good choice if you want to keep all your activities inside your own computer without having to install anything else.  

*System requirements: Qubes OS requires a very powerful computer. This can be a hindrance for some, but if you feel that you really need to protect yourself against potential digital attacks, the investment may be worth it (https://www.qubes-os.org/doc/SystemRequirements/).

* Documentation: https://www.qubes-os.org/doc/

To sum up, we shouldn’t look at those tools as ‘silver bullets’ or a ‘magic potion’ that will make you invulnerable. Nevertheless, by using any of these options according to your needs and resources, you will raise the level of effort that an attacker will need to harm you, making a successful attack—as well as harmful human errors—less likely.  

'''Relevant links:'''  

* Wider comparison of other such operating systems:(https://www.whonix.org/wiki/Comparison_with_Others)

* Qubes developer Johanna Rutowska describes how she partitioned her life into security domains: http://blog.invisiblethings.org/2011/03/13/partitioning-my-digital-life-into.html

This chapter of the manual has looked at how to include gender into individual security and privacy practices by focusing on the question of identity; explored what digital traces are and what they can ‘tell’ about us individually and how we can regain control of those traces and the stories they tell others about us. It also covered how mapping our various social domains can help us manage our lives and activities more safely, and explored how creating different types of separate online identities can be a powerful tool for working and playing online safely.   

But most of us also want to safely communicate and organise with others online. So, how do you create and maintain pockets of community online that are safe, trusted havens for sharing, support, and dialogue between those who share common goals, views, or ideas (whether it be within your organisation or more broadly within your communities).  

Given the hostility, types of digital gender-based violence, and targeting we can experience online, what are strategies for increasing our visibility and resistance in inhospitable spaces which exclude or harm us. This second chapter of the manual looks beyond the choices and practices available to us at the individual level, and delves into the creation and management of spaces that are safe for us—both online and offline.  

== <big>Safe Spaces</big> ==

Safe spaces can be understood as spaces that are created though explicit community agreement, or through an implicit sharing of values. They enable members of a group to flourish, create community, and empower themselves. Safe environments for discussion and awareness-raising have played a key role in many women's liberation movements as well as other social movements.  

As explained by holistic security trainer Sandra Ljubinkovic, safe spaces in the context of training events are important for any integrated approach to security because they enable a supportive environment that helps people express their emotions without fearing any judgment: “Creating a safe space is crucial for creating a sense of physical safety as well as a sense of confidence in a group. It is important for participants who usually have no time to relax to feel comfortable and enjoy simple things­. And if they live in a country where their lives are in danger, it is even more crucial to make sure that they feel physically safe. Safe space in a group means a space to feel comfortable and speak openly and freely about feelings, challenges, and emotions as they may arise. In the workshops where issues personally affect people (whether those are physical, emotional, or spiritual threats and challenges), participants may have strong emotions as they do their own inner work facing their own oppression, privilege, anger, hurt, pain and suffering”.  

Safe spaces can be temporary and take place during a one-time event or training (as described above), or they can also become permanent spaces where collectives or organisations embed the basic principles of safety, support, respect, and inclusiveness in their own space management. They can also be established online among a group of trusted individuals.  

Whatever format or style is used, a safe space should allow women and trans* persons to access and learn about technology and related fields without having to fear intimidation or embarrassment, sexist language and attitudes, or being challenged, mocked or mansplained. There are many possible event formats and styles which can support the creation of safe spaces, both online and offline, that allow women, trans* persons, and other individuals to communicate and collaborate in a nurturing and welcoming environment.  

You may assume that the online communities you create or take part in through social media, discussion lists, and chat channels are inherently democratic, non-hierarchical, participatory, and relatively safe. However, within online spaces the same hierarchies, privileges, and power relations that exist in society in the offline world can be reproduced. It's important to be mindful of this and to think through ways to mitigate and limit these downsides in order to get the most utility out of the virtual and physical spaces we have. Using these strategies is about caring for ourselves and for the communities we are part of. Making these issues explicit and visible is also about agency, social justice, and feminism, by helping us shape the spaces that we care about, use to organize, and within which we grow.  

This section will first focus on strategies of resistance in large online public spaces that are not inherently safe for all users, such as Twitter and Wikipedia. These examples are designed to give us insight into how we can work collectively to create safety online by using certain tactics and strategies, such as developing and using feminist counterspeech, and ‘storming’ and ‘swarming’ together in order to protect and support each other.   

Secondly, the section will also look at the offline world and discuss how we can build safe spaces in the physical world in order to host privacy and digital security trainings and activities for narrowing the gender gap in tech.

Finally, this chapter looks at building safe spaces online to enable better—and safer—collaborations through the use of mailing lists, chat rooms, forums, wikis, etherpads, blogs, and alternative social networking platforms. It will also look at how to use these tools tactically to support the creation and maintenance of safe spaces. The tools that have been highlighted in this section have been included because they are free and open source software (FOSS) instead of for-profit tools that prevent users from understanding how they work. Because they are completely open for the public to look at, review, and improve, FOSS tools are openly designed and administered, and tend to have increased privacy and security features that can minimise the amount of traces we create online.   

It's important to remember (and remind others) that most of the alternative tools and service providers we refer to in this section are not profit-oriented and are often managed (and even paid for out-of-pocket) by volunteers. Additionally, most of them do not accept government funding in order to retain autonomy and because they are not 'formal', 'for-profit' entities that have the resources to manage grants. Therefore, most of these 'free' online services and tools rely on volunteers and contributions to sustain their work. You can support these alternative services and tools by volunteering to help with various tasks (e.g., documentation, translations, training, coding, etc.), but also with funding contributions, since they all require certain levels of funds in order to sustain their networks and services (for example, see this breakdown of annual costs for austici: https://www.autistici.org/en/who/costs.html). So, we suggest making it a habit: Whenever you, your network, or your organization uses FOSS tools and services, please help sustain these key resources with whatever contribution (voluntary or monetary) you're able to provide.

Use these services? Donate or volunteer using the links below:

'''Further Readingsː'''  

* Digital Security – from silencing to claiming safe spaces by GenderIT: (http://www.genderit.org/feminist-talk/digital-security-silencing-claiming-safe-spaces)

* Politicizing Self-Care and Wellbeing in Our Activism as Women Human Rights Defenders: (http://www.awid.org/news-and-analysis/politicizing-self-care-and-wellbeing-our-activism-women-human-rights-defenders)

* 6 Reasons Why We Need Safe Spaces: (http://everydayfeminism.com/2014/08/we-need-safe-spaces/)

* What is an online safe space: (http://safespacenetwork.tumblr.com/Safespace)

* Caring Queer Feminist Communities: (http://www.thefeministwire.com/2014/04/caring-queer-feminist-communities/)

== <big>Safe spaces in the public sphere (online and offline)</big> ==

There are a number of virtual and physical spaces that feel hostile—or less safe—for women and trans* persons because they explicitly or implicitly exclude us and other marginalized groups. We may also discover that apparently safe and welcoming spaces end up harbouring bigots. When we feel restrained, harrassed or intimidated, there are a number of things we can do. One way to proactively care for our personal and collective safety is by using appropriate security- and privacy- enhancing tools and techniques, as well as safely managing our online identities. Another is working with others to craft methods for reclaiming a sense — or space — of safety in the public sphere. Organising collective actions can also be powerful acts of resistance, bringing attention and visibility to the reality of marginalized individuals’ experiences of abuse and lack of safe spaces, and this in turn can help bring about transformation.  

=== Counterspeech ===

Creating counter-narratives online, or ‘talking back’, is one strategy for making sexism and gender-based violence visible in response to online attacks and harassment. It can be an effective tactic, creating a sense of belonging and making visible the effectiveness of collective feminist actions online.  

Counterspeech can be used for exposing hate/deceit/abuse/stereotypes, promoting counter-narratives and clarifying facts, advancing counter values, uniting communities and sharing experiences. When planning for counterspeech it is important to ask who should be aimed at, what will be the main objectives driving the speech (awareness, changing norms, support target, share experiences), and how it will be achieved (parody, humor, mock, fact checking, call for action/consequences)? For example, there are many examples of feminist counterspeech in actionː

* The Everyday Sexism Project (https://twitter.com/everydaysexism), for example, catalogues instances of sexism experienced by women on a day-to-day basis

* #sirtimizidonuyoruz (#weturnourbacks) hashtag was used by Turkish women, and men, to post pictures showing them turning their backs to sexist statements made by president Erdogan.

* The more recent women scientists campaign showing what #DistractinglySexy (https://twitter.com/search?q=%23DistractinglySexy&src=typd) looks like after a nobel laureate sexist remarks

* Byefelipe (https://instagram.com/byefelipe/) is an  Instagram account which reposts abuse by men who turn hostile when rejected

* The UN Women campaign against the sexist Google autocompletion searchː (http://www.unwomen.org/en/news/stories/2013/10/women-should-ads)

* The feminist gender and tech remix of the book “Barbie: I Can Be a Computer Engineer”: (http://caseyfiesler.com/2014/11/18/barbie-remixed-i-really-can-be-a-computer-engineer)

* Feminist Frequencyː  (http://feministfrequency.com/) This project includes the video series Tropes vs. Women, created by Anita Sarkeesian with Bitch magazine to examine common tropes in depictions of women in film, television and video games, with a particular focus on science fiction. Videos produced in this series include ‘Women in Refrigerators’, ‘The Smurfette Principle’ and ‘Positive female characters in video games’.

==== Storming Wikipedia ====

Feminist counterspeech can also include tactics to enable the inclusion and visibility of women and trans* persons’ contributions inside universal free knowledge platforms such as the Wikipedia. There have been many studies that have criticised the way in which knowledge is produced on Wikipedia. A 2010 survey (https://web.archive.org/web/20100414165445/http://wikipediasurvey.org/docs/Wikipedia_Overview_15March2010-FINAL.pdf) conducted by the United Nations University found that only 13% of Wikipedia contributors identified as female. The fact that Wikipedia’s contributors are mostly men in their twenties and thirties, and disproportionately Western, are important factors that influence content, participation and review.  

Women who have played a significant role in history are also often missing from Wikipedia, and feminist, queer and trans content is often challenged or heavily ‘contested’. For example, changing the name of whistleblower Bradley Manning to Chelsea Manning in Wikipedia became a very complex issue as the following article explains (http://www.theguardian.com/technology/2013/oct/24/chelsea-manning-name-row-wikipedia-editors-banned-from-trans-pages). The lack of gender and cultural diversity in Wikipedia content demands creative responses. This has led to the support and exploration of partnerships, research, community organizing, and socio-cultural and technical interventiont by the Wikimedia Foundation for instance and many other organisations and grass-roots collectives.  

‘Storming Wikipedia’ or organising ‘Edit-a-thons’ are two possible interventions that address the lack of gender and cultural diversity amongst the editors and content on Wikipedia. These two examples of creative interventions can enable participants to collectively learn how to edit Wikipedia content in ways that reflect more accurately their communities and relevant histories. Learning how to edit Wikipedia can seem daunting for many, so collectively editing and creating pages with others in a safe space is a great way to confront one’s hesitations or fears. In addition, participants also learn about Wikipedia’s community values and principles, as well as how such a large community-driven effort has—through the development of bottom-up community rules—become the most important encyclopaedia in the world. All together, Wikipedia remains an important space worth investigating and reclaiming by marginalized individuals and communities across all languages and pages!

Organising a ‘wikistorming’ involves gathering a group of friends (and friends of friends) who want to learn (or already know) how to edit Wikipedia, and then identifying a safe space in which to hold the event. It can be held in someone’s home, in a community centre, at an art centre, or at a community organisation. Wikistorming can—and should—be organised any day, but Ada Lovelace Day in mid-October and International Women's Day on March 8 are two specific days on which such gatherings often happen. A wikistorming can last from a half-day to a whole day. Before wikistorming, decide which Wikipedia entries you may want create, or which existing pages you want to edit. Be realistic about your goals given the length of the wikistorming event, and refrain from adding too many planned edits to your personal editing agenda, since editing Wikipedia carefully takes time.  

'''Relevant links:'''  

* Advice on organising a wikistorming by FemTechNet: http://femtechnet.newschool.edu/wikistorming

* Great examples of wiki storming by Wikimedia: https://blog.wikimedia.org/2015/03/05/wikipedia-edit-a-thons-international-womens-day/

* Lectures about the gender gap in wikipedia and how to overcome it: https://meta.wikimedia.org/wiki/Gender_gap

=== Dealing with Trolls ===

Women and trans persons who have influence online and/or begin to develop an online following may experience what Kathy Siera describes as a ‘Koolaid point’ (http://seriouspony.com/trouble-at-the-koolaid-point/). This is the point at which a certain group of people decide that you have too much influence and make it their mission to silence or discredit you. This is commonly referred to as 'trolling'—although this particular category of gender- and minority-based actions described by Siera are usually targeted, hate-based, and discriminatory in nature. A ‘troll's’ tactics can include anything from sending constant derogatory and belittling messages to editing and distributing offensive images, and even making threats.  

'''''Block or engage?'''''  

If you are not planning to ignore the trolls, then there are two ways you can deal with them. One is to block them and then report them to the platform you are using. The other options is to engage with them. The decision on which way to go depends on what you want to achieve.  

'''Blocking trolls''' can sometimes be effective, and may allow you to continue with your work unimpeded. Projects like Block Together (https://blocktogether.org/) and Block Bot (http://www.theblockbot.com/sign_up) were developed to help people who are harassed share their blocklists with each other.  

When trolls are really committed to harassing you, however, blocking doesn't really help. A determined troll can create numerous different profiles (called ‘sock puppet accounts’) to continue the harassment, and this means your blocking has to keep up with their generation of new accounts. This quickly becomes very tedious. Historically, platforms like Twitter and Facebook have not handled reports of intimidation and online violence very well. However, this is beginning to change as they recognise the severity of problem and see how it deters people with important voices and large numbers of followers (or friends) from using their services.  

You might consider the alternative: engaging the trolls who are harassing you. One way to do this is to try and enter into rational arguments with them and interrogate their views. Another way is to try to shame them, or to use humour to deflate their egos. Effective engagement with trolls can actually help generate debate and public interest around the act of online harassment, and can involve others in online discussions about safe spaces, violence, sexism, and online behaviour. It can also be a source of empowerment for the subjects of trolling—seeing others laugh at your harasser(s) can be very uplifting.